DESCRIPTION Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible. The author considers following items to some of the key features of this application:

*Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.

*Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.

*Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core appli‐ cation in order when extending the supported list of services for brute-forcing.

OPTIONS -h [TARGET] Target hostname or IP address.

-H [FILE] Reads target specifications from the file specified rather than from the command line. The file should contain a list separated by newlines.

-u [TARGET] Target username.

-U [FILE] Reads target usernames from the file specified rather than from the command line. The file should contain a list separated by newlines.

-p [TARGET] Target password.

-P [FILE] Reads target passwords from the file specified rather than from the command line. The file should contain a list separated by newlines.

-C [FILE] File containing combo entries. Combo files are colon separated and in the following format: host:user:password. If any of the three fields are left empty, the respective information should be provided either as a single global value or as a list in a file.

Medusa also supports using PwDump files as a combo file. The format of these files should be user:id:lm:ntlm:::. We look for ’:::’ at the end of the first line to determine if the file con‐ tains PwDump output.

-O [FILE] File to append log information to. Medusa will log all accounts credentials found to be valid or cause an unknown error. It will also log the start and stop times of an audit, along with the calling parameters.

-e [n/s/ns] Additional password checks ([n] No Password, [s] Password = Username). If both options are being used, they should be speci‐ fied together ("-e ns"). If only a single option is being called use either "-e n" or "-e s".

-M [TEXT] Name of the module to execute (without the .mod extension).

-m [TEXT] Parameter to pass to the module. This can be passed multiple times with a different parameter each time and they will all be sent to the module (i.e. -m Param1 -m Param2, etc.)

-d Dump all known modules.

-n [NUM] Use for non-default TCP port number.

-s Enable SSL.

-g [NUM] Give up after trying to connect for NUM seconds (default 3).

-r [NUM] Sleep NUM seconds between retry attempts (default 3).

-R [NUM] Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.

-t [NUM] Total number of logins to be tested concurrently. It should be noted that rougly t x T threads could be running at any one time. 381 appears to be the limit on my fairly boring Gentoo Linux host.

-T [NUM] Total number of hosts to be tested concurrently.

-L Parallelize logins using one username per thread. The default is to process the entire username before proceeding.

-f Stop scanning host after first valid username/password found.

-F Stop audit after first valid username/password found on any host.

-b Suppress startup banner

-q Display module’s usage information. This should be used in con‐ junction with the "-M" option. For example, "medusa -M smbnt -q".

-v [NUM] Verbose level [0 - 6 (more)]. All messages at or below the spec‐ ified level will be displayed. The default level is 5.

The following is the breakdown of the verbose levels: 0) EXIT APPLICATION 1) MESSAGE WITHOUT TAG 2) LOG MESSAGE WITHOUT TAG 3) IMPORTANT MESSAGE 4) ACCOUNT FOUND 5) ACCOUNT CHECK 6) GENERAL MESSAGE

-w [NUM] Error debug level [0 - 10 (more)]. All messages at or below the specified level will be displayed. The default level is 5.

couldn't load "http" [/usr/local/lib/medusa/modules/http.mod: cannot open shared object file: no such file or directory] place the module in the medusa directory, set the MEDUSA_MODULE_NAME environment variable or run the configure script again.